Drupal
Ranked 3 of 9 content management systems by recommenders
Recommended for its mature, battle-tested architecture, large community and built-in features that avoid reinventing a CMS; critics cite frequent major-version rewrites and maintenance and security concerns.
Recommended for its mature, battle-tested architecture, large community and built-in features that avoid reinventing a CMS; critics cite frequent major-version rewrites and maintenance and security concerns.
78 people gave an opinion
- recommend it
- 30
- criticize it
- 48
- approval share
- 38%
Recommended in 9 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 6 years
Median of the 3 owners who said how long they have had it.
Each square is one year.
Why it doesn’t carry the badge
- 30 people recommend itNeeds 10 or more, met.
- 0.6 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Mature, proven solutions to common problems
“build on top of a lot of well discussed well thought through solutions to these sorts of problems that the Drupal community has dealt with for a couple of decades”
Comment from 19 Oct 2026 in “Drupal is now light-years ahead of its reputation” “It's a solid framework to build on without having to reinvent the CMS wheel.”
Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation” “battle tested without having to make all the decisions that get you there”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” - Comment from 10 Nov 2025 in “Modular monolith and microservices: Modularity is what matters”
Built-in features without programming
“It has understood and workable flows for things like content approval, timed releases, etc.”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “Drupal's features and functionality match the requirements of your project the best.”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “if you fully buy into Drupal, it can do most everything without programming”
Comment from 23 Feb 2026 in “Ladybird Browser adopts Rust” Large, active community and ecosystem
“had literally thousands of developers volunteering code to the core development project, a dedicated security team”
Comment from 8 May 2026 in “Canvas (Instructure) LMS Down in Ongoing Ransomware Attack” “the overall ecosystem is so expandable and the community is great”
Comment from 9 Apr 2026 in “Lunar Flyby” “Better code, better community, better architecture etc.”
Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation” Foundation rebuilt over time
“The reason Drupal can do what it does today is because of this willingness to rebuild”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “Drupal can do what it does today because it continually rebuilt it's foundation”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”
What people warn about
Each mark is one comment
Frequent rewrites and breaking changes
“But that rewriting the base system, every couple of years, was why I dropped it.”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “Drupal earned that reputation for so many architectural upheavals and pointless version churning”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “To be fair, they did it once, from v7 to v8. But yeah, a major release does break APIs.”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” - Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”
Security risks and vulnerabilities
“Drupal is no paragon of security”
Comment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE” “This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy”
Comment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation” “it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing”
Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation” Steep learning curve for smaller users
“Modern Drupal is more geared towards coders rather than smaller folks.”
Comment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation” “Drupal was even better, but the barrier to entry was higher.”
Comment from 2 Apr 2026 in “EmDash – a spiritual successor to WordPress that solves plugin security” “I totally saw the value for the client but I really disliked my experience, so I avoided it afterwards.”
Comment from 31 May 2026 in “The Speed of Prototyping in the Age of AI” Hard maintenance, needs SSH access
“There's no way you're using modern Drupal without SSH access and using command line to install and update.”
Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation” “Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).”
Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”
Other content management systems people recommend
The four most recommended other content management systems, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| WordPress | 194 | 326 | 37% | 12 | 15 yrs25 owners | — |
| EmDash | 67 | 91 | 42% | 7 | — | — |
| DrupalThis page | 30 | 48 | 38% | 9 | 6 yrs3 owners | — |
| Wagtail CMS | 11 | 1 | 92% | 5 | — | Approved |
| Sveltia CMS | 7 | 0 | 100% | 5 | — | — |
What people said
40 of the 96 comments that mention it, newest first. Each links to the original comment.
“Modern Drupal is more geared towards coders rather than smaller folks.”
“This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy”
“I like to think of Drupal as the worst CMS, except for all the others.”
“It's a solid framework to build on without having to reinvent the CMS wheel.”
“What came after was such a different beast it should have just been its own thing.”
“it is genuinely a very good product now, and one that LLMs are incredibly good at building with”
“I wouldn't put Drupal or Wordpress near the top of the pile for good ones anyway, but I'd still put them above any bespoke CMS I've ever seen.”
“Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).”
“it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing”
“That's Drupal's strength and I don't think there's anything better for it.”
“Better code, better community, better architecture etc.”
“I came to have a lot of respect for how configuration works in modern Drupal”
“To be fair, they did it once, from v7 to v8. But yeah, a major release does break APIs.”
“When I last tried the Windows version, it didn't work and just gave the old Drupal white screen of death in the browser.”
“There's no way you're using modern Drupal without SSH access and using command line to install and update.”
“The reason Drupal can do what it does today is because of this willingness to rebuild”
“battle tested without having to make all the decisions that get you there”
“Drupal's features and functionality match the requirements of your project the best.”
“Drupal earned that reputation for so many architectural upheavals and pointless version churning”
“But that rewriting the base system, every couple of years, was why I dropped it.”
“Drupal can do what it does today because it continually rebuilt it's foundation”
“It has understood and workable flows for things like content approval, timed releases, etc.”
“The scale of publishing + users + need for governance is exploding.”
“I don't think there is a place for Drupal outside of higher educations marketing.”
“It's actually a great target for agentic coding, because it has such a well-established internal API.”
“build on top of a lot of well discussed well thought through solutions to these sorts of problems that the Drupal community has dealt with for a couple of decades”
“at least you do have a choice or path forward when the situation arises”
“Drupal is no paragon of security”
“will check that it can't write to anything but its designated file uploads directory”
“has had a commit credit system going for years that has worked well enough that people are constantly trying to game it”
“I loved its templating system (the fact that HTML was assembled on the back end) and it was so powerful!”
“Drupal and WP etc all have plugins to switch stuff on in minutes, however, customising and making it as your client wants would take a lot of time.”
“I totally saw the value for the client but I really disliked my experience, so I avoided it afterwards.”
“had literally thousands of developers volunteering code to the core development project, a dedicated security team”
“I recommended we use Drupal in 2011. That was killed because everything had to be MS.”
“the overall ecosystem is so expandable and the community is great”
“Drupal was even better, but the barrier to entry was higher.”
“I always liked the pragmatism surrounding it, reaching to the point of saving php code into the mysql database”
“if you fully buy into Drupal, it can do most everything without programming”
“it's stood the (multi-decade) test of time”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.